close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Administrative fine

Irish DPC fines Google €403M over unlawful location data processing

GDPR

Ireland's Data Protection Commission fined Google Ireland Limited €403 million after finding the company unlawfully processed location data through its Web & App Activity, Location History, and Location Accuracy features between 2018 and 2020, without adequately informing users or maintaining lawful grounds for the processing. It is the fourth-largest GDPR fine since the regulation took effect, and Google must bring its practices into compliance within six months.

Why it matters The fourth-largest GDPR fine ever issued, for tracking exactly the kind of location data most apps collect by default.
Read the primary source
Data Protection Commission (Ireland)
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Settlement / consent order

Meta pays $459M to settle Cambridge Analytica privacy claims with four states

Meta Platforms, Inc.

California

$459,300,000Settled

Eight years after Cambridge Analytica broke, states are still collecting on it. This time it's $459 million, folded into an even larger settlement over Meta's design choices for kids.

Primary source
Settlement / consent order Pending

DOJ’s $400M TikTok privacy settlement hits a snag: a judge may reject part of it

TikTok Inc. and ByteDance Ltd.

COPPA Federal

$400,000,000Pending

A $400M privacy settlement isn't final just because the government announced it: a judge can still send both sides back to the table.

Primary source
Settlement / consent order

Connecticut fines TaxAct $275K for sharing taxpayer data with Meta and Google

TaxAct, Inc.

Connecticut Data Privacy Act (CTDPA) Connecticut

$275,000Settled

The information you enter into tax software feels private by default. This is what happens when a company treats it as ad-targeting data instead.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.